Need to include a certain field from my Log into the Message part of my log without pulling the entire log in

Elastic Stack Logstash
6

Since your message field is a json you could try something like this in your pipeline:

filter {
    mutate {
        add_field => {
            "[message][observer.name]" => "%{[host][name]}"
        }
    }
}

This would add a field named observer.name inside your message field, then your output would be just this: codec => line { format => "%{pipeline} - %{message}"}

1 Like